Advanced Persistent Threats (APTs) TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security architect is reviewing the 2020 SolarWinds attack, where attackers compromised the software build environment and inserted malicious code into a trusted update. The attackers then used the backdoor to access multiple high-value targets. The architect wants to apply lessons learned to their organization's software supply chain. Which measure is most directly aligned with the lessons from this case study?

   • ADeploying more endpoint detection tools on all servers
   • BRestricting outbound internet access from all internal servers
   • CImplementing integrity checks and code signing verification for all software updates
   • DIncreasing the frequency of penetration tests on internet-facing applications
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security manager is reviewing a report about a cyber incident. The report describes an attacker who used a zero-day exploit to gain initial access, then installed a backdoor that survived multiple system reboots, and finally spent six months silently collecting intellectual property. Which characteristic of an APT is most clearly demonstrated by the backdoor surviving reboots?

   • APersistence
   • BAdvanced techniques
   • CExfiltration
   • DTargeted nature
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During an incident response engagement, a forensics analyst reconstructs the following attack timeline: (1) an attacker scanned the organization's external network, (2) the attacker sent a spear-phishing email to an employee, (3) the employee opened the attachment and the attacker gained a foothold, (4) the attacker escalated privileges using a local vulnerability, (5) the attacker accessed a file server and copied sensitive documents, and (6) the attacker transferred the documents to an external server. The analyst wants to identify the stage where the attacker's objective of data theft was achieved. Which stage is most directly associated with the attacker's objective?

   • AInitial compromise, when the attacker gained a foothold
   • BExfiltration, when the documents were transferred to the external server
   • CLateral movement, when the attacker accessed the file server
   • DPrivilege escalation, when the attacker gained higher-level access
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the typical APT lifecycle, which stage directly follows the initial compromise and is focused on establishing a reliable foothold?

   • AExfiltration
   • BCommand and control (C2) establishment
   • CLateral movement
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is investigating a potential APT and finds that an attacker has been using a legitimate remote administration tool (RAT) to control a server. The analyst also notices that the attacker has been creating new user accounts with administrative privileges. Which stage of the APT lifecycle does the creation of new user accounts most directly represent?

   • ALateral movement
   • BPersistence
   • CPrivilege escalation
   • DInitial compromise
   Reveal Solution Discussion Select an answer first